AI agents are the new tenant. And they are a workload unlike anything the cloud has hosted: they write their own code seconds before running it, they succeed by failing fast, they want to fork running machines like processes, and increasingly they get graded by the substrate they run on. None of the existing primitives fit. That’s why the sandbox—isolate, snapshot, fork—is becoming a first-class unit of compute, why the vertical AI pattern has a sandbox box in it, and why there are now entire companies selling nothing else.

Five tenants, five primitives ¶

The comparison is the argument:

Read down the last column and the pattern is clear: this isn’t a smaller function. It’s a different tenant. Every era of compute got the isolation its tenant deserved—and this tenant thinks.

The workload ¶

Six properties make agents unlike everything the cloud has hosted before. Each one forces a primitive.

Untrusted from the inside. Every previous isolation model protected the workload from the world and tenants from each other—the code itself was assumed friendly, because a human wrote and reviewed it. An agent inverts the assumption: the code being executed was written seconds ago by a stochastic process, possibly steered by whatever hostile text the agent read on the way in. The workload is the adversary. CI systems ran semi-trusted code at human cadence with review gates; agents run it at machine speed with none. That forces hard isolation as the default, not the paranoid option—and it makes network egress a security control, not a networking detail, because exfiltration is the first thing a prompt-injected agent tries. The serious platforms ship egress allowlists and full network blocks as first-class sandbox settings.

Mayflies, not cattle. Pets became cattle; cattle are becoming mayflies. The sandbox wants to be born, do one thing, and die—and the death is the product, because destruction is what guarantees the next attempt a clean slate. When the unit of compute lives for seconds, the defining performance metric flips from utilization to cold start, which is why every vendor’s homepage is a millisecond number and why the engineering goes down two roads: kernels stripped until they boot in ~125 milliseconds—Firecracker’s entire design brief—and snapshots that skip booting altogether, memory-mapping a ready machine image back to life in single-digit milliseconds. Warmth stored on disk, not warmth kept running.

State that branches—and pauses. Traditional architecture pushed state out of compute: stateless services, databases of record. Agents want the opposite—forkable execution. Try three fixes from one checkpoint. Branch an RL rollout at the decision point. Pause mid-task for six hours while a human approves the next step, then resume from exactly that machine state at storage prices instead of compute prices. That’s process-level time travel, and no mainstream workload ever demanded it—which is why snapshot, restore, and fork are becoming API surface rather than ops tooling. Memory snapshots already cut cold starts by multiples on the platforms that ship them. The cloud is finally getting a fork() syscall.

Failure is the signal. SRE culture minimizes failure; agent execution harvests it. An agent runs code to find out whether the code works—execution as hypothesis testing, the sandbox as laboratory rather than factory. In RL training this is explicit: each trajectory is an agent trying whatever maximizes reward, side effects included, and every rollout needs a clean world to wreck. So the substrate’s job isn’t five nines of uptime—it’s a fast, rich verdict channel: exit codes, artifacts, diffs, telemetry, and increasingly a score. No previous cloud graded its tenants.

Particle-physics concurrency. One agent task fans into a hundred parallel tool executions. One training experiment is ten thousand rollouts for twenty minutes, then silence. Production platforms already report tens of thousands of concurrent sandboxes for a single customer event, and the training-side operators run hundreds of thousands of concurrent environments. Reactive autoscaling is useless against this shape—the burst is over before the autoscaler notices. What works is snapshot fan-out plus fleet headroom: fork one initialized image into ten thousand copy-on-write clones, so the swarm restores into existence instead of booting into it, on hosts whose spare capacity was provisioned before the burst. (Sizing that headroom is a newsvendor problem—inventory theory has opinions.)

The browser is a device class. For agents, the browser is what the terminal was for humans: the universal interface to everything that never got an API. That makes browser-in-a-sandbox a standard SKU, not an exotic one—a live Chromium session with the same containment as a code sandbox plus three things code sandboxes never needed: session persistence, credential handling, and a human-takeover path. It’s why the managed-browser vendors (Browserbase, Steel, Hyperbrowser) look less like scraping tools every quarter and more like a compute primitive. The browser is the new SSH.

What is a sandbox, really ¶

Containers isolated you from your neighbors—namespaces and cgroups drawing lines between tenants who all ran code they trusted. Agent sandboxes must isolate you from the workload itself, and three lineages compete on how:

Firecracker gives every sandbox its own kernel—a container escape ends at that VM’s wall. E2B and Vercel’s sandboxes take this path. gVisor interposes a user-space kernel that filters syscalls before they reach the host—lower overhead, no separate kernel—and it’s how Modal isolates. Kata wraps containers in lightweight VMs, splitting the difference. The detail worth savoring: this entire lineage was built over the past decade for multi-tenant serverless, an era when the threat was your neighbor. Then a tenant arrived whose threat is itself, and the isolation stack turned out to be accidental preparation. Call it the isolation dividend.

The trace ¶

What actually happens when an agent runs pip install && pytest:

Every stage exists because of a property above. The placement step exists because of particle-physics concurrency. The snapshot restore exists because of mayfly lifetimes. The egress gate exists because the workload is the adversary. The verdict exists because failure is the signal. And the final fork option exists because the most valuable thing a finished sandbox can do is become two sandboxes. This is the request path of a cloud whose unit of work is the attempt.

Four demand curves ¶

One primitive, four buyers:

Inference—production agents acting—is the visible curve, and it prices like serverless. Training is the steep one: RL on agentic tasks consumes environments in parallel thousands per experiment, an environments marketplace has formed on top (Prime Intellect’s hub carries thousands of open RL environments; Mechanize builds them for labs), and the frontier labs have reportedly discussed spending over a billion dollars a year on environments alone. An RL environment, stripped of ceremony, is a sandbox plus a reward function—sandboxes with rubrics. Evals are the third curve and the quiet constant: every serious agent team replays production traces and runs simulated adversaries inside the same isolation, which means the eval harness from the anatomy post is a sandbox customer whether it knows it or not.

The fourth curve is the one the agent loop doesn’t contain: serving. The app-generation platforms—the Lovable class—produce software whose runtime is a sandbox: the preview URL behind a vibe-coded app is a microVM with a tunnel to it, and production platforms have run tens of thousands of them concurrently for a single customer. This is where the title stops being a metaphor, because AI-written software doesn’t become trusted when it starts working—the isolation follows the artifact into production, and the sandbox literally is the server. (It also prices like hosting rather than attempts—the exception that maps the boundary.) Step back and all four curves are the same substrate activity, arbitrary code execution, distinguished only by what the buyer wants back: a result, a gradient, a grade, an uptime.

Compute for attempts ¶

Follow the pricing unit and you can watch the industry reprice itself. VMs sold instance-hours—you paid for existence. Functions sold invocations—you paid for events. Sandboxes sell session-minutes and forks—you pay for attempts. That’s the honest unit for a tenant whose job is trying things, and it has a property the old units didn’t: attempt volume scales with model capability, not with end-user traffic. Every improvement in agent reliability increases how much work gets delegated, which increases attempts. The demand curve compounds from the supply side.

The market structure is a squeeze. From above: the hyperscalers and the labs are bundling execution primitives into their agent platforms, and a bundled good-enough sandbox is how platforms have always eaten adjacent categories. From below: the isolation layer is open source—Firecracker, gVisor, Kata—so the moat can’t be the wall itself. What’s left, and it’s real, is everything around the wall: cold-start engineering measured in single-digit milliseconds, fleet scheduling that absorbs particle-physics bursts, snapshot infrastructure that makes fork cheap, and the rubric layer that turns execution into judgment. Sovereignty pressure cuts the same way it did in the vertical AI stack: data-residency rules and national-AI programs push execution inside jurisdictional boundaries—and the category has already split along exactly that line. E2B and Steel ship open-source runtimes you can stand up inside your own cloud; Modal and Vercel’s sandboxes are managed-only, no BYOC. In a sovereign world that split is strategy, not packaging: the open-runtime vendors can follow demand into any boundary—and must find their moat in fleet operations, since anyone can run their wall—while the closed ones either build a deployable story or cede every regulated deal to the open source underneath.

Objections ¶

Isn’t this just Lambda? No—by construction. Functions assume trusted code; sandboxes assume the opposite. Functions have no fork, no browser, no verdict channel, and duration caps that make a six-hour human-approval pause impossible. Lambda priced the event. This prices the attempt.

Aren’t containers enough? Not when the author is adversarial. A shared kernel plus a workload that writes its own syscalls is exactly the threat model containers were never asked to hold—and containers have no snapshot semantics, so the fork property dies at the runtime.

Haven’t sandboxes existed forever? As features, yes—coding judges, CI runners, notebook hosts, and plugin platforms have executed untrusted code for decades, each building its isolation internally, each for one narrow job. Agents changed the volume (machine cadence), the generality (any task), and the buyer (everyone shipping agents). The activity is old. The standalone market is what’s new.

Are servers actually dying? No, and the title doesn’t need them to. The claim is about the marginal unit: where new compute demand lands. It’s landing in attempts.

The primitive, mapped ¶

The arc that started with time-sharing ends, for now, with a tenant that thinks, fails on purpose, and gets graded—and a primitive shaped exactly like it. The attempt is becoming a billable unit of compute. Billable units of compute have a way of becoming industries.